Splunk fixed tens of flaws in Splunk Enterprise and Cloud Platform

Pierluigi Paganini July 04, 2024

Technology company Splunk released security updates to address 16 vulnerabilities in Splunk Enterprise and Cloud Platform.

Technology company Splunk addressed 16 vulnerabilities in Splunk Enterprise and Cloud Platform, including four high-severity flaws.

The vulnerability is a Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise.

“In Splunk Enterprise versions below 9.0.10, 9.1.5, and 9.2.2, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could cause a Remote Code Execution through an external lookup that likely references the “splunk_archiver“ application.” reads the . “The “splunk_archiver“ application likely contains a script called “copybuckets.py“ that itself references a file called “erp_launcher.py“, which would likely execute a script called “sudobash. The “sudobash“ script does not perform any input checking. Therefore it runs a bash shell with arguments supplied by the “erp_launcher.py“ file. This can lead to an RCE.”

Splunk Enterprise versions 9.2.2, 9.1.5, and 9.0.10, or higher address the issue, the company also recommends disabling the “splunk_archiver“ application to temporarily mitigate the issue.

The company addressed another high-serverity bug, tracked as CVE-2024-36984, which is a Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows.

“In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code.” reads the . “The exploit requires the use of the collect SPL command which writes a file within the Splunk Enterprise installation. The attacker could then use this file to submit a serialized payload that could result in execution of code within the payload.”

Splunk Enterprise versions 9.2.2, 9.1.5, and 9.0.10, or higher address the issue.

If users do not log in to Splunk Web on indexers in a distributed environment, disabling Splunk Web on those indexers can mitigate the issue.

Below is the list of the addressed flaws:

SVDDateTitleSeverityCVE
2024-07-01High
2024-07-01Medium
2024-07-01Medium
2024-07-01Medium
2024-07-01Medium
2024-07-01Medium
2024-07-01Medium
2024-07-01High
2024-07-01Medium
2024-07-01Medium
2024-07-01Informational
2024-07-01Medium
2024-07-01Medium
2024-07-01High
2024-07-01High
2024-07-01High
2024-07-01High
2024-07-01High

The company did not reveal if one of these vulnerabilities was actively exploited in the wild.

Follow me on Twitter:  and  and Mastodon

(SecurityAffairs – hacking, RCE)



you might also like

leave a comment